Memory Leak Vulnerability in Linux Kernel Affecting TPM2 Sessions

CVE-2026-46096

What is CVE-2026-46096?

A memory leak vulnerability exists in the Linux kernel within the TPM2 sessions component. The issue arises in the tpm2_read_public() function, which properly initializes a buffer but fails to release it in certain error conditions, resulting in memory leaks. Specifically, the function neglects to call tpm_buf_destroy() when an unrecognized hash algorithm leads to an error and also on the success exit path. This oversight can lead to increased memory usage and degradation of system performance, highlighting the necessity for proper buffer management in software development.

References